The application surface: enumerate, subscribe, and device-list (M18.3)

Applications ask the device manager for the tree (enumerate: a header
plus ChildEntry records) and subscribe to published add/remove events by
handing their endpoint over as the call's capability — the input-service
pattern; events are the same ChildAdded/ChildRemoved structs the bus
drivers send, one encoding in both directions. device-list is the first
client: it prints the tree, subscribes, and narrates the events through
a driver restart. The protocol's message maximum is capped at the
kernel's IPC MESSAGE_MAXIMUM (256 bytes, ten entries per reply; paging
joins the protocol when a tree outgrows one message). The startUserTask
debug print is gone: it wrote to serial unserialized against user-space
lines and sheared concurrent log markers in half — the root cause of the
scenario flakes.

docs/device-manager.md

@@ -7,8 +7,10 @@ cap are in — usb-xhci-bus is the first conforming driver, and the
 Tree reports are built too (M18.2, 2026-07-13): the xHCI driver scans its
 root-hub ports and reports each connected device (`child_added`); the manager
 mirrors them and prunes a dead reporter's children, and the `usb-report`
-scenario proves report → prune → respawn → re-report. The application surface
-(M18.3) remains design. The primitives underneath are real ([process-management.md](process-management.md):
+scenario proves report → prune → respawn → re-report. The application surface is built (M18.3, 2026-07-13):
+`enumerate` and `subscribe` over IPC, with `device-list` as the first client —
+the manager is now the one answer to "what devices exist" for applications.
+The primitives underneath are real ([process-management.md](process-management.md):
 spawn/supervise/kill/exit-notification; [driver-model.md](driver-model.md): the device
 table as a capability system; [drivers.md](drivers.md): claim/map/IRQ), and the first
 per-device driver spawn works (the device manager matches the xHCI controller by PCI